Processing of personal data

Information pursuant to Art. 13 GDPR on the processing of personal data

I. Scope

This data protection information pursuant to Art. 13 GDPR applies to the collection of personal data by NAVAX Software GmbH, with the exception of the collection of personal data via the NAVAX Software GmbH website (www.navax-software.com). This information therefore applies in particular to personal data communicated to NAVAX Software GmbH by post, telephone, fax, or email.

Note: The collection of personal data by NAVAX Software GmbH via its website (www.navax-software.com) is subject to a separate privacy policy of NAVAX Software GmbH (www.navax-software.com/datenschutz).

II. Responsibility

NAVAX
Software GmbH is responsible for the processing
of your personal data. Birketweg 21
80639 Munich, Germany
Phone: +49 (89) 78000-0
Fax: +49 (89) 78000-590
Email: kontakt@navax.com

III. Contact details of the data protection officer at NAVAX Software GmbH

dsgvoschutzteam.com - Lukmann Consulting GmbH
Packerstraße 131a
AT-8561 Söding
Phone: +49 (7223) 95 666 77
Email: service@dsgvoschutzteam.com

IV. Purposes and legal basis of processing

We collect, process, and use personal data if you provide us with this data and we are entitled to collect, use, and process it on the basis of your consent or on the basis of a legal provision.

Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). Personal data includes:

Last name, first name, professional activity/position, employer, address, telephone number, marital status, date of birth, gender, email address

The above-mentioned personal data is processed for the following purposes:

Communication regarding products, services, and projects, e.g., to process inquiries or to create customized offers
Initiation, planning, implementation, and management of the (contractual) business relationship between NAVAX Software GmbH and its customers, suppliers, and other business partners
Invitations to events and trade shows, conducting surveys, marketing campaigns, market analyses, or similar activities
Provision of information and advertising regarding new products and services (subject to consent)
Maintaining and protecting the security of our products and services as well as our websites, preventing and detecting security risks, fraudulent activities, or other criminal or malicious acts
Compliance with legal requirements (e.g., tax and commercial law retention obligations) or existing obligations to carry out compliance screenings (to prevent white-collar crime or money laundering).

The processing of personal data is necessary to achieve the above-mentioned purposes, including the execution of the (contractual) business relationship with the business partner. Unless expressly stated otherwise, the legal basis for data processing is Art. 6 (1) (b) and (f) of the GDPR or the expressly granted consent (Art. 6 (1) (a) of the GDPR) of our customers, suppliers, and other business partners.

The data you provide to us will be treated confidentially. We will not sell your personal data to third parties or market it in any other way.

The data will not be made available to third parties for use unless you have given your consent or we are legally entitled or obliged to pass on this data.

To the extent that it is legally permissible and necessary to comply with applicable law or to assert, exercise, or defend legal claims, we transfer personal data to courts, tax authorities, and supervisory authorities. However, we take all measures to ensure appropriate and adequate safeguards for the protection of your personal data.

V. Storage period and storage deadlines

Unless an explicit storage period is specified at the time of collection (e.g., in a declaration of consent), personal data will be deleted as soon as it is no longer required to fulfill the purpose of storage, unless statutory retention obligations (e.g., commercial and tax law retention obligations) prevent deletion.

VI. Recipients or categories of recipients

As a rule, personal data that you provide to us about yourself will only be processed by NAVAX Software GmbH. However, in order to fulfill our tasks, it may be necessary in individual cases for us to transfer the personal data stored about you to our service providers, tax authorities, or other authorities.

Data will only be transferred to service providers in the USA if this is required for the specified purpose and then exclusively on the basis of the standard contractual clauses in their currently valid version, as well as in compliance with additional guarantees. This ensures that your data is also processed in accordance with data protection regulations in the USA.

VII. Your rights

Right to information: You can request information about your personal data processed by us in accordance with Art. 15 GDPR. You can also request that we provide you with a copy of the data being processed free of charge.
Right to rectification: If the information concerning you is not (or no longer) accurate, you can request rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
Right to erasure: You may request the erasure of your personal data under the conditions of Art. 17 GDPR. We have also implemented technical measures to inform all recipients of your data and third parties of your right to request erasure or correction and restriction of processing if we have disclosed or made your data public to them. All links, copies, and replications of your personal data will be deleted. Your right to erasure depends, among other things, on whether we still need the data concerning you to fulfill our legal obligations.
Right to restriction of processing: Within the framework of the provisions of Art. 18 GDPR, you have the right to request a restriction on the processing of data concerning you.
Right to data portability: In addition, pursuant to Art. 20 GDPR, you may request that the data you have provided to our company be provided to you in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from the controller to whom the data was provided.
Right to object: Pursuant to Art. 21 GDPR, you have the right to object to the processing of data concerning you at any time for reasons arising from your particular situation. Withdrawing your consent does not make past data processing unlawful. In addition, you have the right to object to direct marketing and profiling in connection with advertising at any time with effect for the future (Article 21(2) of the GDPR).
Withdrawal of consent: If data processing is based on your consent, you also have the right to withdraw your consent to data processing at any time without giving reasons with effect for the future in accordance with Art. 7 (3) GDPR. Withdrawing your consent does not make past data processing unlawful.
Right to lodge a complaint: If you believe that we have not complied with data protection regulations when processing your data, you can lodge a complaint with us. The contact details of our company's data protection officer can be found under III. You also have the right to complain to the competent supervisory authority about the data processing carried out by our company.

The data protection authority responsible for our company is:

State Office for Data Protection Supervision
Promenade 27 (Schloss)
91522 Ansbach, Germany
Internet: www.lda.bayern.de

Status of this information: November 10, 2025